CVE-2006-6761

published 2006-12-27

CVE-2006-6761: Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via a…

Priority P3 49 medium 6.5 CVSS 2.0

AV N AC L Au S C P I P A P

EXPLOIT

Stack-based buffer overflow in the IMAP daemon (IMAPD) in Novell NetMail before 3.52e FTF2 allows remote authenticated users to execute arbitrary code via a long argument to the SUBSCRIBE command.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
novell	netmail	—	—

Detection & IOCs extracted from sources · hover to see the quote

command a002 SUBSCRIBE #<1602-byte string><payload>\xeb\x06<2 bytes><ret>↗

other 0x75022ac4↗

bytes↗

\xeb\x06

• → Detect oversized IMAP SUBSCRIBE command arguments; a payload of ~1602+ bytes following the SUBSCRIBE verb is indicative of exploitation of CVE-2006-6761. ↗
• → The exploit targets Novell NetMail 3.52 IMAP service on Windows 2000 SP0-SP4; monitor IMAP traffic (default port 143) for abnormally long SUBSCRIBE arguments exceeding normal mailbox name lengths. ↗
• → The exploit requires prior authentication (remote authenticated users); monitor for authenticated IMAP sessions issuing anomalously large SUBSCRIBE commands. ↗
• → The exploit payload bad characters are null byte, LF, CR, and space (\x00\x0a\x0d\x20); detection signatures should account for these constraints in the payload stream. ↗
• → The short JMP (\xeb\x06) near-jump sequence embedded after the overflow buffer is a reliable in-stream indicator of this specific exploit's shellcode trampoline. ↗

• · The Metasploit module only targets Windows 2000 SP0-SP4 English with a hardcoded return address; exploitation against other OS versions or service packs requires a different return address. ↗
• · Exploitation requires prior valid authentication to the IMAP service; unauthenticated access alone is insufficient to trigger the vulnerability. ↗
• · The payload space is constrained to 500 bytes with a stack adjustment of -3500; payloads exceeding this space or containing bad characters (\x00, \x0a, \x0d, \x20) will not function correctly. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.